Solvers compute against shielded state. The chain sees a finished trade.
Occlusion shields solver intents using a note-commitment scheme derived from Zcash's Orchard protocol. A Bittensor subnet audits the public trace after every execution for anything that still leaked.
protocol: shielded-intent · chain: robinhood (4663) · proof: halo2 · status: pre-audit
The route is a commitment, not an order.
An intent is encrypted into an Orchard-derived note. Solvers bid against the commitment and split execution across intermediate shielded nodes. Nothing readable enters the mempool, so there is no path to front-run and no ordering to sandwich. Settlement is atomic within a single 100ms block.
3 routes · 1 block · unlinkable
One subnet, two jobs: route privately before, audit publicly after.
Each epoch, subnet validators are sampled by stake into a rotating t-of-n committee, with t set above n/2. The trader Shamir-secret-shares the intent across them. The committee computes the best route with mixed-protocol MPC: arithmetic sharing for the pricing math, garbled circuits for comparing routes. It outputs a threshold-signed route decision. No single node ever sees the plaintext amount.
t-of-n threshold · no single node sees the amount
After settlement the amount and route are public. The subnet recomputes the best achievable fill from public pool data at the settlement block and compares it to what was delivered. Deviations beyond a tolerance band are flagged and update the solver's public integrity score. Correctness is checked after the fact rather than proven in zero knowledge beforehand.
- Settlement read from chainInput amount and executed route are public after the atomic reveal.
- Best fill recomputedMaximal output for that amount, from pool states at the settlement block.
- Delivered vs. benchmarkDeviation inside the tolerance band is normal; beyond it is flagged.
- Solver integrity score updatedSubnet consensus written to the registry; flagged fills put the bond at risk.
OCC is collateral for solvers. Traders never touch it.
- —Solvers stake OCC in the Solver Registry to operate.
- —Routing priority scales with integrity score × √bond — not bond size alone.
- —A withdrawal timelock stops a solver exiting before a pending audit resolves.
- —Confirmed bad execution slashes the bond, paid to the affected trader.
- —Traders never need to hold or spend OCC to use Occlusion.
One loop: intent in, audited settlement out.
The pattern has already been observed on-chain.
This isn't a hypothetical. In September 2026, independent researchers traced a live sandwich-attack pattern against solvers on Robinhood Chain: a wallet probing routes ahead of execution, then front-running the trade it revealed. The two reports below documented it in public.
The reports describe a probe-then-revert pattern: cheap transactions test candidate routes in public, revert, and leak the route before the real trade lands. Shielded intents remove the mechanism this pattern depends on. Route search never happens as public, revertible transactions — solvers compute against a commitment, and the chain only sees the settled result.
no probe transactions ever reach the public mempool
Ship shielded routing in an afternoon.
- —Typed SDK for TypeScript, with intent construction and proof generation handled client-side.
- —Signed webhooks for every settlement and leak-flag event.
- —Testnet and live keys inferred from the key prefix — no environment switch.
// submit a shielded swap intent
import { Occlusion } from "@occlusion/sdk";
const occ = new Occlusion(process.env.OCC_KEY);
// route stays sealed until settlement
const intent = await occ.intents.submit({
chainId: 4663,
sell: { token: "ETH", amount: "12.5" },
buy: { token: "USDC" },
maxSlippageBps: 30,
shield: "orchard",
});
console.log(intent.commitment, intent.status);Concept — pre-audit, not yet deployed.
- Shielded pool design
- Orchard-derived · specification draft
- Solver registry
- Not deployed
- Bittensor subnet
- Not registered
- Target chain
- Robinhood Chain · id 4663
- Settlement asset
- Native ETH
- Token
- OCC · solver bonding only · not issued
- Audit status
- Pre-audit
What is Occlusion?+
Routing infrastructure for Robinhood Chain. A swap is submitted as a shielded intent. The route stays hidden until the block in which it executes.
How is this different from a private mempool?+
A private mempool hides an order from the public until inclusion, but the operator sees it. A shielded intent is encrypted to the settlement circuit; solvers bid against a commitment, not a readable order.
What does Orchard actually do here?+
Orchard's note and nullifier construction is repurposed. Instead of hiding a balance, the note commits to a pending trade intent. Spending the note proves the intent existed without disclosing its contents.
What does the subnet catch?+
It audits the public trace after execution: timing correlation, size fingerprinting, solver collusion patterns, repeated address linkage. Findings adjust solver integrity scores.
Is this live?+
No. Everything on this page is concept and specification. Nothing is deployed.
Do I need an Occlusion token?+
Not as a trader. OCC is required for solvers to bond and operate: it is collateral that can be slashed when the audit finds execution below the public benchmark. Traders never need to hold or spend it. OCC has not been issued; any contract address shown is illustrative.